awesome-threat-detection

✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️
https://github.com/0x4D31/awesome-threat-detection

Last synced: 6 days ago
JSON representation

Resources
- Related Awesome Lists
- Email Monitoring
  - ThreatHunter-Playbook - A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.
  - Alerting and Detection Strategy Framework
  - Generating Hypotheses for Successful Threat Hunting
  - Expert Investigation Guide - Threat Hunting
  - Threat Hunting for Fileless Malware
  - Windows Commands Abused by Attackers
  - On TTPs
  - Slides
  - Threat Hunting Techniques - AV, Proxy, DNS and HTTP Logs
  - Detecting Malware Beacons Using Splunk
  - Data Science Hunting Funnel
  - Use Python & Pandas to Create a D3 Force Directed Network Diagram
  - Syscall Auditing at Scale
  - Catching attackers with go-audit and a logging pipeline
  - The Coventry Conundrum of Threat Intelligence
  - DFIR - security-summit/archives/cyber-defense)) - Threat hunting, Blue Team and DFIR summit slides
  - Bro-Osquery - Large-Scale Host and Network Monitoring Using Open-Source Software
  - Threat Hunting with Jupyter Notebooks
  - How Dropbox Security builds tools for threat detection and incident response
  - Introducing Event Query Language
  - The No Hassle Guide to Event Query Language (EQL) for Threat Hunting - EQLforThreatHunting.pdf))
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Defining ATT&CK Data Sources - A two-part blog series that outlines a new methodology to extend ATT&CK’s current data sources.
  - DETT&CT: MAPPING YOUR BLUE TEAM TO MITRE ATT&CK™ - A blog that describes how to align MITRE ATT&CK-based detection content with data sources.
  - Lessons Learned in Detection Engineering - A well experienced detection engineer describes in detail his observations, challenges, and recommendations for building an effective threat detection program.
  - A Research-Driven process applied to Threat Detection Engineering Inputs
  - Investigation Scenario
  - Oh My Malware - A video series focused on malware execution and investigations using Elastic Security.
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - A Research-Driven process applied to Threat Detection Engineering Inputs
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - A Research-Driven process applied to Threat Detection Engineering Inputs
  - Part 1, - cd-detection-engineering-splunk-s-attack-range-part-2.html)[and Part 3](https://www.splunk.com/en_us/blog/security/ci-cd-detection-engineering-failing-part-3.html) - A multipart series describing how detection as code can be successfully deployed in a Splunk environment.
- Windows
  - Active Directory Threat Hunting
  - Windows Logging Cheat Sheets
  - Windows Commands Abused by Attackers
  - JPCERT - Detecting Lateral Movement through Tracking Event Logs
  - Splunking the Endpoint: Threat Hunting with Sysmon
  - Hunting with Sysmon
  - Threat Hunting with Sysmon: Word Document with Macro
  - Part I (Event ID 7)
  - Part II (Event ID 10)
  - botconf 2016 Slides - Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf))
  - The Sysmon and Threat Hunting Mimikatz wiki for the blue team
  - Splunkmon — Taking Sysmon to the Next Level
  - Sysmon Threat Detection Guide - SysmonThreatAnalysisGuide.pdf))
  - Paper - 17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And%20Evasion-Using-Science.pdf))
  - Hunting the Known Unknowns (With PowerShell)
  - HellsBells, Let's Hunt PowerShells!
  - Hunting for PowerShell Using Heatmaps
- Frameworks
  - MITRE ATT&CK - A curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target.
  - A Simple Hunting Maturity Model - The Hunting Maturity Model describes five levels of organizational hunting capability, ranging from HMM0 (the least capability) to HMM4 (the most).
  - The Pyramic of Pain - The relationship between the types of indicators you might use to detect an adversary's activities and how much pain it will cause them when you are able to deny those indicators to them.
  - The PARIS Model - A model for threat hunting.
  - Cyber Kill Chain - It is part of the Intelligence Driven Defense® model for identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective.
  - The DML Model - The Detection Maturity Level (DML) model is a capability maturity model for referencing ones maturity in detecting cyber attacks.
  - NIST Cybersecurity Framework
  - MITRE Engage - A framework for planning and discussing adversary engagement operations that empowers you to engage your adversaries and achieve your cybersecurity goals.
  - MaGMa Use Case Defintion Model - A business-centric approach for planning and defining threat detection use cases.
- Osquery
  - osquery Across the Enterprise
  - osquery for Security — Part 1
  - osquery for Security — Part 2 - Advanced osquery functionality, File integrity monitoring, process auditing, and more.
  - Tracking a stolen code-signing certificate with osquery
  - Monitoring macOS hosts with osquery
  - The osquery Extensions Skunkworks Project
  - osquery Across the Enterprise
  - osquery Across the Enterprise
  - osquery Across the Enterprise
- Blogs
- DNS
  - Detecting DNS Tunneling
  - Hunting the Known Unknowns (with DNS)
  - Detecting dynamic DNS domains in Splunk
  - Random Words on Entropy and DNS
  - Tracking Newly Registered Domains
  - Suspicious Domains Tracking Dashboard
  - Proactive Malicious Domain Search
  - DNS is NOT Boring - Using DNS to Expose and Thwart Attacks
  - Actionable Detects - Blue Team Tactics
- Fingerprinting
- Research Papers
Tools
- - MITRE ATT&CK Navigator - attack/attack-navigator)) - The ATT&CK Navigator is designed to provide basic navigation and annotation of ATT&CK matrices, something that people are already doing today in tools like Excel.
  - Uncoder - An online translator for SIEM saved searches, filters, queries, API requests, correlation and Sigma rules
  - Capa - An open-source tool to identify capabilities in executable files.
- Endpoint Monitoring
  - Sysmon - A Windows system service and device driver that monitors and logs system activity to the Windows event log
- Network Monitoring
  - Moloch - A large scale and open source full packet capture and search tool
Detection Rules
- Email Monitoring
  - Splunk Detections
  - MITRE CAR - The Cyber Analytics Repository is a knowledge base of analytics developed by MITRE based on the Adversary Tactics, Techniques, and Common Knowledge (ATT&CK™) adversary model.
Dataset
- Email Monitoring
  - SecRepo.com - Samples of security related data.
  - EMBER - The EMBER dataset is a collection of features from PE files that serve as a benchmark dataset for researchers
  - CIC Datasets - Canadian Institute for Cybersecurity datasets
  - Netresec's PCAP repo list - A list of public packet capture repositories, which are freely available on the Internet.
Podcasts
- Related Awesome Lists
  - Cloud Security Podcast
  - Detection: Challenging Paradigms
  - Darknet Diaries - True stories from the dark side of the Internet.
Videos
- Related Awesome Lists
Trainings
- Related Awesome Lists
  - Applied Network Defense
  - Security Blue Team
  - TryHackMe - Hands-on cyber security training through real-world scenarios.
  - Investigating Windows Endpoints
  - HackTheBox - While not directly related to threat detection, the website features training modules on general security and offensive topics that can be beneficial for junior SOC analysts.
  - TryHackMe - Hands-on cyber security training through real-world scenarios.
Labs
- Related Awesome Lists
  - Splunk Boss of the SOC - Hands-on workshops and challenges to practice threat hunting using the BOTS and other datasets.
Twitter
- Related Awesome Lists
  - "Awesome Detection" Twitter List - Twitter accounts that tweet about threat detection, hunting and DFIR.
Threat Simulation Resources
- Related Awesome Lists
  - MITRE's Adversary Emulation Plans
  - Payload Generation using SharpShooter
  - SpecterOps Blog
  - Threat Hunting
  - Advanced Threat Tactics - A free course on red team operations and adversary simulations.
  - C2 Matrix - GR4zGZi0ooPYtBe4IgPsSc))
  - SpecterOps Blog
  - Threat Hunting
  - SpecterOps Blog
  - Threat Hunting

Programming Languages

Categories

Resources 122 Videos 27 Threat Simulation Resources 10 Trainings 6 Tools 5 Dataset 4 Podcasts 3 Detection Rules 2 License 1 Labs 1 Twitter 1

Sub Categories

Related Awesome Lists 53 Email Monitoring 49 Fingerprinting 19 Windows 17 DNS 9 Osquery 9 Frameworks 9 Blogs 7 Research Papers 5 Network Monitoring 1 Endpoint Monitoring 1

Keywords

awesome-list 4 awesome 3 list 3 security 2 honeyd 1 honeypot 1 cybersecurity 1 dfir 1 incident-response 1 incident-response-tooling 1 analysis-framework 1 automated-analysis 1 chinese 1 chinese-translation 1 domain-analysis 1 drop-ice 1 dynamic-analysis 1 malware-analysis 1 malware-collection 1 malware-research 1 malware-samples 1 network-traffic 1 static-analysis 1 threat-intelligence 1 threat-sharing 1 threatintel 1